Load og:image preview even if Content-Length header is missing

ts/linkPreviews/linkPreviewFetch.ts

@@ -177,6 +177,11 @@ const isInlineContentDisposition = (headerValue: string | null): boolean =>
   !headerValue || headerValue.split(';', 1)[0] === 'inline';
 
 const parseContentLength = (headerValue: string | null): number => {
+  if (headerValue == null) {
+    // If no Content-Length header is given, assume the max allowed value
+    return MAX_IMAGE_CONTENT_LENGTH;
+  }
+
   // No need to parse gigantic Content-Lengths; only parse the first 10 digits.
   if (typeof headerValue !== 'string' || !/^\d{1,10}$/g.test(headerValue)) {
     return Infinity;
@@ -567,6 +572,14 @@ export async function fetchLinkPreviewImage(
     return null;
   }
 
+  const { type: contentType } = parseContentType(
+    response.headers.get('Content-Type')
+  );
+  if (!contentType || !VALID_IMAGE_MIME_TYPES.has(contentType)) {
+    logger.warn('fetchLinkPreviewImage: Content-Type is not an image; bailing');
+    return null;
+  }
+
   const contentLength = parseContentLength(
     response.headers.get('Content-Length')
   );
@@ -575,17 +588,7 @@ export async function fetchLinkPreviewImage(
     return null;
   }
   if (contentLength > MAX_IMAGE_CONTENT_LENGTH) {
-    logger.warn(
-      'fetchLinkPreviewImage: Content-Length is too large or is unset; bailing'
-    );
-    return null;
-  }
-
-  const { type: contentType } = parseContentType(
-    response.headers.get('Content-Type')
-  );
-  if (!contentType || !VALID_IMAGE_MIME_TYPES.has(contentType)) {
-    logger.warn('fetchLinkPreviewImage: Content-Type is not an image; bailing');
+    logger.warn('fetchLinkPreviewImage: Content-Length is too large; bailing');
     return null;
   }
 
@@ -597,6 +600,12 @@ export async function fetchLinkPreviewImage(
     return null;
   }
 
+  // Second check for image size in case there is no Content-Length header
+  if (data.length > MAX_IMAGE_CONTENT_LENGTH) {
+    logger.warn('fetchLinkPreviewImage: Image size is too large; bailing');
+    return null;
+  }
+
   if (abortSignal.aborted) {
     return null;
   }

ts/test-electron/linkPreviews/linkPreviewFetch_test.ts

@@ -1280,7 +1280,7 @@ describe('link preview fetching', () => {
       );
     });
 
-    it('returns null if the response is too large', async () => {
+    it('returns null if the Content-Length is too large', async () => {
       const fakeFetch = stub().resolves(
         new Response(await readFixture('kitten-1-64-64.jpg'), {
           headers: {
@@ -1302,7 +1302,32 @@ describe('link preview fetching', () => {
       sinon.assert.calledOnce(warn);
       sinon.assert.calledWith(
         warn,
-        'fetchLinkPreviewImage: Content-Length is too large or is unset; bailing'
+        'fetchLinkPreviewImage: Content-Length is too large; bailing'
+      );
+    });
+
+    it('returns null if the actual image is too large', async () => {
+      const fakeFetch = stub().resolves(
+        new Response(await readFixture('tina-rolf-269345-unsplash.jpg'), {
+          headers: {
+            'Content-Type': 'image/jpeg',
+          },
+        })
+      );
+
+      assert.isNull(
+        await fetchLinkPreviewImage(
+          fakeFetch,
+          'https://example.com/img',
+          new AbortController().signal,
+          logger
+        )
+      );
+
+      sinon.assert.calledOnce(warn);
+      sinon.assert.calledWith(
+        warn,
+        'fetchLinkPreviewImage: Image size is too large; bailing'
       );
     });